The present invention relates generally to the detection and prevention of malicious attacks over computer networks and, more particularly, to the automatic detection of large-scale denial of service attacks.
As computer networks have increased in number, size and complexity, the number of attacks directed toward those networks has also increased. One such type of attack, known as a denial of service (DoS) attack is an attack on a computer network that may cause a loss of service to users, typically by consuming the bandwidth of a network or by overloading the computational resources of the network. In these attacks, a target network is typically flooded with an overwhelming number of packets to saturate the network connections and/or to deplete network resources. A common way of initiating such attacks is via Distributed Denial of Service (DDoS), which typically uses a widely-distributed network of computers that have been compromised (e.g., via viruses, Trojan horse or other well-known means) to permit an attacker to control the computers remotely. Then, at a time of the attacker's choosing, these compromised computers attack the target simultaneously and flood that target with packets.
As a result of the threat posed by DDoS attacks, attempts have been made to detect such attacks and, ultimately, to prevent them. Such prior detection techniques generally used either coarse-grained detection techniques or, alternatively, fine-grained detection techniques to identify anomalies that could indicate a DDoS attack was underway. As used herein, the term coarse-grained data is defined as data from which only a high-level overview of the flow of data, such as time series trends, may be obtained. Analysis of such coarse-grained data to detect DDoS attacks typically involves time-series forecasting and signal processing to detect larger, more significant events that could indicate a DDoS attack. On the other hand, the term fine-grained data is defined as data from which a detailed analysis of individual elements or clusters of elements of data can be obtained. Analysis of fine grained data, for example, enables the analysis of flow or packet-header data to detect much more subtle events indicative of a DDoS attack. In some implementations, such techniques are deployed in monitoring systems within the core of the service provider network. However, implementing such monitoring systems in the traffic-heavy core network using either technique makes it difficult to detect the relatively subtle indications of some attacks that, while possibly small relative to the aggregate traffic in the core network, could still overwhelm a targeted network. Additionally, fine-grained detection techniques usually are not suitable for such traffic-intensive monitoring for the additional reason that these techniques require significant processing capabilities and/or time to detect such subtle anomalies and, as a result, are relatively more expensive to implement.
Other detection methods have been developed for use by an end user (i.e., a customer of a service provider) to detect DDoS attacks. However, such methods are typically ineffective at detecting the DDoS attacks prior to loss of service. This is because, once a DDoS attack begins, the bandwidth capacity of the access link connecting the user to a service provider may quickly become consumed and/or the packet handling capacity of routers of the service provider or user can be quickly overloaded. Thus, once this occurs, there is little that the target of the attack can do independently to alleviate the loss of service.